JP7033733B2 - Data analyzers, methods, and programs - Google Patents

Description

The present disclosure relates to a technique for analyzing data on a computer network, and particularly to a technique for analyzing data in a manufacturing system.

In recent years, we have aimed to improve productivity, create unprecedented value, and build new business models by linking with goods and services inside and outside the factory via communication networks such as the Internet. Efforts are being actively carried out.

On the other hand, in the Internet space, cyber attacks by hacking and malware are becoming active. Cases of unauthorized intrusion and information leakage due to cyber attacks are increasing year by year, and cases of production suspension and equipment destruction have been reported in factory manufacturing systems. Therefore, it is necessary to improve the security level of the manufacturing system by detecting an abnormality that has occurred in the manufacturing system having a computer network.

For example, Patent Document 1 describes an example of a mechanism for improving the security level of a control system. The system of Patent Document 1 aggregates abnormality notifications transmitted from monitoring units corresponding to each of a plurality of control systems, and evaluates the reputation of the control system suspected of having an abnormality. If it is determined to be abnormal according to the evaluation results, the outbound traffic from at least the protected area is restricted to the protected area in which the control system suspected of being abnormal is operating.

Further, in a manufacturing system in a factory, each manufacturing apparatus is connected via a network and manufactures while communicating with each other. If the manufacturing equipment connected to such a network is hijacked by an unauthorized operation or the data flowing through the network is falsified, defective products may be manufactured or the manufacturing equipment may be destroyed. In order to deal with this, for example, Patent Document 2 describes an attack detection device that detects an illegal act from network data.

Japanese Unexamined Patent Publication No. 2012-168755 Japanese Unexamined Patent Publication No. 2016-19028

However, in order to introduce a mechanism for detecting an abnormality as described in Patent Document 1, it is necessary to drastically change the existing manufacturing system.

Since the attack detection device of Patent Document 2 detects an attack only from the window information stored in the header of the packet used for communication, it is not always possible to detect the attack with high accuracy. Further, from the window information stored in the header of the packet, it cannot be detected as an abnormality that a failure or the like has occurred in the manufacturing system.

The present disclosure is intended to detect anomalies in a manufacturing system without significant modification to the existing manufacturing system.

The data analysis device according to the present disclosure is a data analysis device that analyzes data transmitted in a manufacturing system having a manufacturing device, a manufacturing control device that controls the manufacturing device, and the manufacturing control device and the manufacturing device. From the receiver that receives the first packet transmitted to and from the received IP address and port number in the header of the first packet, the data included in the payload of the first packet received. An analyzer for determining the type, a selector for selecting a syntax or a rule corresponding to the type of data based on the type of data determined by the analyzer, and data contained in the payload of the data. It has a determination device for determining that there is an abnormality in the manufacturing system when the syntax or rules corresponding to the type are not followed.

According to this, it is possible to receive a packet transmitted between the manufacturing control device and the manufacturing device in the manufacturing system and determine that there is an abnormality in the manufacturing system from the contents thereof. Since the received packet is a packet normally used in the manufacturing system regardless of the data analyzer, it can be easily known that there is an abnormality in the manufacturing system.

The data analysis method according to the present disclosure is a data analysis method for analyzing data transmitted in a manufacturing system having a manufacturing apparatus and a manufacturing control apparatus for controlling the manufacturing apparatus, the manufacturing control apparatus and the manufacturing apparatus. To receive a packet transmitted to and from, and to obtain the type of data contained in the payload of the received packet from the IP address and port number included in the header of the received packet. Select the syntax or rule corresponding to the type of data based on the type of data given, and if the data contained in the payload does not follow the syntax or rule corresponding to the type of data. It has to determine that there is an abnormality in the manufacturing system.

The data analysis program according to the present disclosure is a data analysis program for causing a computer to execute a data analysis method for analyzing data transmitted in a manufacturing system having a manufacturing apparatus and a manufacturing control apparatus for controlling the manufacturing apparatus. The data analysis method receives a packet transmitted between the manufacturing control device and the manufacturing device, and receives the packet from an IP address and a port number included in the header of the received packet. The type of data contained in the payload is determined, the syntax or rule corresponding to the type of data is selected based on the obtained type of data, and the data contained in the payload is the data. If the syntax or rules corresponding to the types of the above are not followed, it is determined that there is an abnormality in the manufacturing system.

According to the present disclosure, anomalies in a manufacturing system can be detected without making major modifications to an existing manufacturing system. Therefore, it is possible to detect an attack from the outside of the manufacturing system, a failure inside the manufacturing system, or the like at low cost.

FIG. 1 is a block diagram showing a configuration example of a manufacturing system including a data analyzer according to an embodiment of the present invention. FIG. 2 is a diagram showing a configuration example of a packet flowing through the network of FIG. 1. FIG. 3 is a diagram showing an example of an IP packet format. FIG. 4 is a diagram showing an example of a TCP packet format. FIG. 5 is a diagram showing an example of a UDP packet format. FIG. 6 is a diagram showing an example of the correspondence between the combination of IP addresses and the like included in the header of the packet and the type of data included in the payload of the packet in the manufacturing system of FIG. FIG. 7 is a state transition diagram showing an example of the state transition of the manufacturing apparatus of FIG. FIG. 8 is a diagram showing an example of a control command format. FIG. 9 is a diagram showing an example of the syntax of the control command. FIG. 10 is a diagram showing an example of the format of the operation record notification. FIG. 11 is a diagram showing an example of the syntax of the operation record notification. FIG. 12 is a block diagram showing a configuration example of the data analysis device of FIG. FIG. 13 is a flowchart showing an example of the operation of the data analyzer of FIG. FIG. 14 is a flowchart showing a modified example of the flowchart of FIG. FIG. 15 is a diagram showing an example of the order of control commands in the normal state. FIG. 16 is a diagram showing an example of the order of control commands at the time of abnormality. FIG. 17 is a flowchart showing a further modification of the flowchart of FIG. FIG. 18 is a diagram showing an example of the order of the operation record information in the normal state. FIG. 19 is a diagram showing an example of the order of operation record information at the time of abnormality. FIG. 20 is a flowchart showing a further modification of the flowchart of FIG. FIG. 21 is a state transition diagram of the manufacturing apparatus, showing the transition probability from each state to the next state. FIG. 22 is a diagram showing an example of a rule regarding the probability of state transition of the manufacturing apparatus in the normal state. FIG. 23 is a diagram showing an example of information regarding the actual occurrence probability of the control command at the time of abnormality. FIG. 24 is a diagram showing an example of information regarding the actual occurrence probability of the operation record information at the time of abnormality. FIG. 25 is a diagram showing an example of information regarding the actual occurrence probability of the state transition of the manufacturing apparatus at the time of abnormality. FIG. 26 is a diagram showing an example of a rule regarding the probability of occurrence of the next command in the normal state. FIG. 27 is a diagram showing an example of a rule regarding the probability of occurrence of the next operation record information in a normal state. FIG. 28 is a flowchart showing a further modification of the flowchart of FIG. FIG. 29 is a state transition diagram of the manufacturing apparatus, showing the time from each state to the next state. FIG. 30 is a diagram showing an example of a rule regarding the time required for the state transition of the manufacturing apparatus in the normal state. FIG. 31 is a diagram showing an example of information regarding the actual time until the output of the control command at the time of abnormality. FIG. 32 is a diagram showing an example of information regarding the actual time until the output of the operation record information at the time of abnormality. FIG. 33 is a diagram showing an example of information regarding the actual time required for the state transition of the manufacturing apparatus at the time of abnormality. FIG. 34 is a diagram showing an example of a rule regarding the time until the output of the next command in the normal state. FIG. 35 is a diagram showing an example of a rule regarding the time until the output of the next operation record information in the normal state. FIG. 36 is a block diagram showing a configuration example of a computer system that realizes the data analysis device according to the embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. The components indicated by the same reference numbers in the drawings are the same or similar components.

FIG. 1 is a block diagram showing a configuration example of a manufacturing system including a data analyzer according to an embodiment of the present invention. The manufacturing system 100 of FIG. 1 includes a network 2, a manufacturing control device 10, manufacturing devices 22 and 24, and a data analysis device 30. The manufacturing control device 10, the manufacturing devices 22, 24, and the data analysis device 30 are connected by a network 2.

The manufacturing control device 10 controls the entire manufacturing system 100. The manufacturing control device 10 transmits, for example, control commands and data for manufacturing to the manufacturing devices 22 and 24, and the manufacturing devices 22 and 24 transmit, for example, their own state and the like to the manufacturing control device 10 as operation record information. do. Each of the manufacturing devices 22 and 24 is a device that performs at least one step for manufacturing a product. The manufacturing system 100 may have more manufacturing equipment or may have only one manufacturing equipment.

The network 2 is, for example, a LAN (local area network), and may be a wired network or a wireless network. The network 2 may be connected to the Internet. The data analysis device 30 is connected to the network 2 so that it can receive data flowing through the network 2, particularly data transmitted and received between the manufacturing control device 10 and the manufacturing device 22 or 24. For example, the network 2 allows data transmitted and received between the manufacturing control device 10, the manufacturing devices 22 and 24, and the data analysis device 30, which are the components of the manufacturing system 100, to be received by any of these components. It may be configured, or the data analyzer 30 may be connected to the mirror port of the router used in the network 2. In FIG. 1, the numbers below each component indicate an example of an IP (internet protocol) address assigned to that component.

FIG. 2 is a diagram showing a configuration example of a packet (also referred to as a frame) flowing through the network 2 of FIG. FIG. 3 is a diagram showing an example of an IP packet format. The IP packet is the packet of FIG. 2 with the Ethernet (registered trademark) header removed. The IP header contains a source IP address and a destination IP address.

FIG. 4 is a diagram showing an example of a TCP (transmission control protocol) packet format. FIG. 5 is a diagram showing an example of a UDP (user datagram protocol) packet format. A TCP packet or UDP packet is an IP packet from which an IP header has been removed. The TCP header or UDP header contains a source port number and a destination port number.

FIG. 6 is a diagram showing an example of the correspondence between the combination of IP addresses and the like included in the header of the packet and the type of data included in the payload of the packet in the manufacturing system 100 of FIG. In FIG. 6, for example, the combination A of the source IP address 192.168.10.1, the destination IP address 192.168.10.10, and the destination port number 10000 is shown to correspond to the control command as the data type of the payload. At this time, the source port number may have any value. Explaining this with reference to FIG. 1, it can be seen that the packet from the manufacturing control device 10 to the port number 10000 of the manufacturing device 22 contains a control command in the payload.

Further, for example, it is shown that the combination B of the source IP address 192.168.10.10, the source port number 20000, and the destination IP address 192.168.10.1 corresponds to the operation record notification as the data type of the payload. At this time, the destination port number may have any value. Explaining this in accordance with FIG. 1, it can be seen that the packet from the port number 20000 of the manufacturing apparatus 22 to the manufacturing control apparatus 10 includes the operation record notification in the payload.

FIG. 7 is a state transition diagram showing an example of the state transition of the manufacturing apparatus 22 of FIG. Here, it is assumed that the manufacturing apparatus 22 is, for example, an apparatus for mounting electronic components on a printed circuit board. The manufacturing apparatus 22 receives a control command from the manufacturing control apparatus 10 by a packet. The state of the manufacturing apparatus 22 transitions in the order of the standby state, the board loading state, the board mounting state, and the board unloading state, as shown in FIG. 7, according to the reception of the control command or the end of the operation instructed by the control command. The manufacturing apparatus 22 transmits an operation record notification to the manufacturing control apparatus 10 by a packet when the state changes. The manufacturing apparatus 24 is also configured in the same manner as the manufacturing apparatus 22.

FIG. 8 is a diagram showing an example of a control command format. The control command has a control command number field and a control parameter field. FIG. 9 is a diagram showing an example of the syntax of the control command. As shown in FIG. 9, for example, the control command number must be 0, 1, 2, or 3. For example, if the control command number is 0, the control parameters must be 0, 1, 2, or 3. For example, if the control command number is 1, 2, or 3, the control parameter must be 0 or 1. Such a rule regarding the possible values of each field of the control command is referred to as a control command syntax.

The control command may have a field for storing a checksum and a message authentication code (MAC). There are also provisions for possible values for checksums and MACs, and such provisions are also included in the control command syntax.

FIG. 10 is a diagram showing an example of the format of the operation record notification. The operation record notification has an operation record notification number field, an operation record information field, and a board number field. FIG. 11 is a diagram showing an example of the syntax of the operation record notification. As shown in FIG. 11, for example, the operation record notification number must be 0, 1, 2, 3, 4 or 5. For example, when the operation record notification number is 0, the number represented by the operation record information field bits 20, 19 must be 0, 1, 2, or 3, and the operation record information field bit 31-21. The number represented by must be in the range 0-1023. The board number is counted up from 0 to 1 each time one board is produced. However, after 32767, it is reset to 0. Therefore, the substrate number must be in the range 0 to 32767. Such a rule regarding the values that can be taken by each field of the operation record notification is referred to as an operation record notification syntax.

The control command and the operation record notification may be composed of binary data or a character string such as ASCII characters. The manufacturing control device 10 may transmit the control command encrypted by, for example, an encryption key, and the manufacturing devices 22 and 24 and the data analysis device 30 may decrypt the encrypted control command. The manufacturing devices 22 and 24 may transmit the operation record notification encrypted by, for example, an encryption key, and the manufacturing control device 10 and the data analysis device 30 may decrypt the encrypted operation record notification.

FIG. 12 is a block diagram showing a configuration example of the data analysis device 30 of FIG. The data analysis device 30 includes a transceiver 32, an analyzer 34, a selector 36, a determination device 38, and a storage device 42.

The transceiver 32 receives the packet transmitted between the manufacturing control device 10 and the manufacturing device 22 or 24 from the network 2 and outputs the packet to the analyzer 34. The analyzer 34 stores the correspondence as shown in FIG. 6 in advance. The analyzer 34 obtains the type of data included in the payload of the received packet from the IP address and port number included in the header of the received packet, for example, based on the correspondence of FIG. 6, and causes the selector 36 to obtain the type of data. Output.

The storage device 42 stores in advance a syntax or a rule corresponding to the type of data, for example, a syntax of a control command and a syntax of an operation record notification. The selector 36 selects and reads out the syntax or the rule corresponding to the type of data obtained by the analyzer 34 from the data stored in the storage device 42.

The determination device 38 determines that the manufacturing system 100 has an abnormality when the data contained in the payload does not follow the syntax or rule corresponding to the data type read from the storage device 42, and determines the determination result as data. Notify the outside of the analyzer 30. For example, the determination device 38 outputs the determination result to the transceiver 32, and the transceiver 32 generates a packet including the determination result and transmits it to the manufacturing control device 10. In the present specification, the abnormality includes not only an abnormality caused by an attack from the outside of the manufacturing system 100 but also an abnormality caused by a failure in the manufacturing system 100.

FIG. 13 is a flowchart showing an example of the operation of the data analysis device 30 of FIG. In block B12, the transceiver 32 of FIG. 12 receives a packet from the network 2, removes its Ethernet header, and outputs the packet to the analyzer 34. In block B14, the analyzer 34 obtains the data type of the payload of the input packet from the IP address and the port number of the input packet according to the correspondence relationship of FIG. 6 stored in advance. The analyzer 34 outputs the type to the selector 36 together with the packet. For example, when the source IP address is 192.168.10.1, the destination IP address is 192.168.10.10, and the destination port number is 10000, the analyzer 34 is a control command in which the data type of the payload is as shown in FIG. , And ask for that.

In the block B16, the selector 36 selects and reads the syntax corresponding to the type of data obtained by the analyzer 34 from the data stored in the storage device 42. The selector 36 outputs the read syntax to the determination device 38 together with the input packet. When the data type of the payload is a control command, the information as shown in FIGS. 8 and 9 is read out as a syntax. In block B18, the determiner 38 decodes the payload of the input packet according to the syntax read by the selector 36.

In block B22, the determination device 38 determines whether or not the decrypted payload data has a syntax violation. As shown in FIG. 8, the control command has a 16-bit control command number field and a 16-bit control parameter field. These 16-bit fields can represent integers from 0 to 65535. However, if the payload data type is a control command, the value of the control command number field must be an integer from 0 to 3, as shown in FIG. Therefore, if the value of the control command number field is other than an integer from 0 to 3, the determination device 38 determines that there is a syntax violation.

Further, as shown in FIG. 9, when the value of the control command number field is 0, the value of the control parameter field must be an integer from 0 to 3. If the value of the control command number field is 1, 2, or 3, the value of the control parameter field must be 0 or 1. Therefore, if the value of the control command number field is 0 and the value of the control parameter field is other than an integer from 0 to 3, the determination device 38 determines that there is a syntax violation. Further, when the value of the control command number field is 1, 2, or 3, and the value of the control parameter field is other than 0 or 1, the determination device 38 determines that there is a syntax violation.

If there is a syntax violation, the process proceeds to block B24, and if there is no syntax violation, the process proceeds to block B26. In the block B24, the determination device 38 determines that there is an abnormality in the manufacturing system 100, and notifies the determination result. The determination device 38 transmits the determination result to the manufacturing control device 10 via, for example, the transceiver 32 and the network 2. Further, the determination device 38 may display the determination result on the display. In block B26, the determination device 38 determines that the manufacturing system 100 is normal. When the block B24 or B26 ends, the processing of one packet ends. After that, the process of FIG. 13 may be repeated.

A case where the type of data of the payload is the operation record notification as shown in FIG. 10 will be described. For example, when the source IP address is 192.168.10.10, the source port number is 20000, and the destination IP address is 192.168.10.1, in block B14, the analyzer 34 uses the operation record notification as the payload data type. It is determined that there is, according to the correspondence relationship in FIG. When the data type of the payload is the operation record notification, the information as shown in FIGS. 10 and 11 is read out as a syntax from the storage device 42 in the block B16.

As shown in FIG. 10, the operation record notification has a 16-bit operation record notification number field, a 16-bit operation record information field, and a 32-bit board number field. When the data type of the payload is operation record notification, the value of the operation record notification number field must be an integer from 0 to 5, as shown in FIG. Therefore, when the value of the operation record notification number field is other than an integer from 0 to 5, in the block B22, the determination device 38 determines that there is a syntax violation.

For each operation record notification number, the value of the bit field of the operation record information field must be a value as shown in FIG. Therefore, when the value of the bit field of the operation record information field is not the value as shown in FIG. 11, in the block B22, the determination device 38 determines that there is a syntax violation. Further, when the value of the board number field is other than an integer from 0 to 32767, the determination device 38 determines in the block B22 that there is a syntax violation. Further, if the value in the board number field is not counted up even though the production of one board is completed, there is a possibility that the board has been stolen. Therefore, in the block B22, the judgment device is used. 38 determines that there is a syntax violation.

As described above, according to the data analysis device 30 of FIG. 12, the packet transmitted between the manufacturing control device 10 and the manufacturing device 22 or 24 in the manufacturing system 100 is received, and the manufacturing system 100 has an abnormality from the contents thereof. It can be determined that. Since the received packet is a packet normally used in the manufacturing system 100 regardless of the data analyzer 30, it is possible to detect an abnormality in the manufacturing system without significantly modifying the existing manufacturing system. .. Therefore, it is possible to detect an attack from the outside of the manufacturing system, a failure inside the manufacturing system, or the like at low cost.

FIG. 14 is a flowchart showing a modified example of the flowchart of FIG. The flowchart of FIG. 14 is different from the flowchart of FIG. 13 in that it has blocks B216 and B 222 instead of blocks B 16 and B 22, respectively. Further, after the blocks B24 and B26, the processing returns to the block B12. Since other points are the same as those in FIG. 13, the description thereof will be omitted.

In block B216, the selector 36 selects and reads the syntax and rules corresponding to the type of data obtained by the analyzer 34 from the data stored in the storage device 42. The selector 36 outputs the read syntax and rules to the determiner 38 together with the input packet. For example, when the data type of the payload is a control command, the information as shown in FIG. 8 is read as a syntax, and further, the order of the control command types is read as a rule.

FIG. 15 is a diagram showing an example of the order of control commands in the normal state. At normal times, as shown in FIG. 15, the board carry-in command (command number 1), the board mounting command (command number 2), and the board carry-out command (command number 3) are repeated in this order. In block B216, such an order is read out as a rule.

In block B222, the determiner 38 determines whether the order of the information indicated by the data contained in the decoded payload violates the rule. Here, the determination device 38 determines whether or not the order of the types of control commands violates the rules.

FIG. 16 is a diagram showing an example of the order of control commands at the time of abnormality. As shown in FIG. 15, the control command of the board mounting command should be a board unloading command. However, in FIG. 16, the third control command is a board carry-in command instead of a board carry-out command. Even though the board has not been carried out, the board carry-in command has been given, and if this command is executed, the manufacturing apparatus 22 or the like may be damaged. Therefore, in the case of FIG. 16, when the third control command is input, the determination device 38 determines that the order of the types of control commands violates the rule. If there is a rule violation, the process proceeds to block B24, and if there is no rule violation, the process proceeds to block B26.

As described above, the rules selected and read from the data stored in the storage device 42 include the information indicated by the data contained in the payload of the packet and the data contained in the payload of the packet received before this packet. The order with the information shown may be specified. More specifically, for example, the payload of the packet contains the first control command, the payload of the packet received before this packet contains the second control command, and the first control command is the second. The rules may specify the order between these control command types if they are the following commands of the control command.

FIG. 17 is a flowchart showing a further modification of the flowchart of FIG. The flowchart of FIG. 17 is different from the flowchart of FIG. 13 in that it has blocks B316 and B322 instead of blocks B16 and B22, respectively. Since other points are the same as those in FIG. 13, the description thereof will be omitted.

In block B316, the selector 36 selects and reads the syntax and rules corresponding to the type of data obtained by the analyzer 34 from the data stored in the storage device 42. The selector 36 outputs the read syntax and rules to the determiner 38 together with the input packet. For example, when the data type of the payload is the operation record notification, the information as shown in FIG. 10 is read out as a syntax, and further, the order of the operation record information types included in the operation record notification is read out as a rule. ..

FIG. 18 is a diagram showing an example of the order of the operation record information in the normal state. At normal times, as shown in FIG. 18, the operation record notification (notification number 1) including the board loading time as the operation record information, the operation record notification (notification number 2) including the board mounting time as the operation record information, and the board as the operation record information. The operation record notification (notification number 3) including the delivery time is repeated in this order. In block B316, such an order is read out as a rule.

In block B322, the determination device 38 determines whether or not the order of the types of operation record information violates the rule. FIG. 19 is a diagram showing an example of the order of operation record information at the time of abnormality. As shown in FIG. 18, the next operation record information of the board mounting time should be the board unloading time. However, in FIG. 19, the third operation record information should be the board carry-out time, which is the board carry-in time. In such a case, it is considered that there is an abnormality in the manufacturing system 100. For example, it is suspected that a failure or falsification of a packet by a third party has occurred. Therefore, in the case of FIG. 19, when the third operation record information is input, the determination device 38 determines that the order of the types of the operation record information violates the rule. If there is a rule violation, the process proceeds to block B24, and if there is no rule violation, the process proceeds to block B26.

As described above, the payload of the packet contains the first operation record information, the payload of the packet received before this packet contains the second operation record information, and the first operation record information is the second operation. The rules may specify the order between these types of operational performance information if they are the following information in the performance information.

FIG. 20 is a flowchart showing a further modification of the flowchart of FIG. The flowchart of FIG. 20 is different from the flowchart of FIG. 13 in that it has blocks B416 and B422, respectively, instead of blocks B16 and B22, and further has block B420. Since other points are the same as those in FIG. 13, the description thereof will be omitted. In FIG. 20, the packet payload contains a control command or an operation record notification.

FIG. 21 is a state transition diagram of the manufacturing apparatus 22, showing the transition probability from each state to the next state. FIG. 22 is a diagram showing an example of a rule regarding the probability of state transition of the manufacturing apparatus 22 in the normal state. In FIG. 22, the current state (transition source) of the manufacturing apparatus 22, the next state (transition destination), the planned transition probability, the control command for the manufacturing apparatus 22 to transition the state, and the manufacturing apparatus 22 are shown. The operation record information in the operation record notification that occurs when the state is changed is specified. The scheduled probability that each control command and each operation record information will be generated is the same as the scheduled probability of the corresponding transition. For example, when the manufacturing apparatus 22 is in the board loading state, the probability of transitioning to the board mounting state next is 90%, and at the time of the transition, a board mounting command for transitioning the state is generated. , An operation record notification including the time required to carry in the board and the device status information as the operation record information is generated. For columns where control commands are not described, transitions occur even if control commands do not occur. Information as shown in FIG. 22 is statistically obtained in advance and stored in the storage device 42. Similar information is stored in the manufacturing apparatus 24.

In block B416, the selector 36 selects and reads the syntax and rules corresponding to the type of data obtained by the analyzer 34 from the data stored in the storage device 42. The selector 36 outputs the read syntax and rules to the determiner 38 together with the input packet. For example, information as shown in FIGS. 8 and 10 is read out as a syntax, and further, a rule as shown in FIG. 22 is read out.

In block B420, the determination device 38 obtains the actual occurrence probability of the transition to the next state, the control command, or the operation record information for each state of FIG. 21. The determination device 38 obtains such an occurrence probability while sequentially performing reception processing of a plurality of packets.

In the block B422, the determination device 38 determines whether or not the error of any of the actual occurrence probabilities, that is, the difference between any of the actual occurrence probabilities and the scheduled probabilities is equal to or greater than a predetermined threshold value. If the difference between any of the actual occurrence probabilities and the scheduled probabilities is equal to or greater than a predetermined threshold value, the process proceeds to block B24, and in other cases, the process proceeds to block B26.

FIG. 23 is a diagram showing an example of information regarding the actual occurrence probability of the control command at the time of abnormality. The error threshold is assumed to be 10%. According to the rule of FIG. 22, when the manufacturing apparatus 22 is in the standby state, the probability that the substrate carry-in command for the manufacturing apparatus 22 to transition to the board carry-in state should be a planned probability of 100%, but in FIG. 23, , Actually 80%. Since the error of the probability of occurrence is 20%, in the block B422, the determination device 38 determines that the difference between the actual probability and the planned probability is equal to or greater than a predetermined threshold value.

FIG. 24 is a diagram showing an example of information regarding the actual occurrence probability of the operation record information at the time of abnormality. The error threshold is assumed to be 10%. According to the rule of FIG. 22, when the manufacturing apparatus 22 is in the standby state, the probability that the operation record notification including the equipment status information is generated when the manufacturing apparatus 22 transitions to the board loading state should be a planned probability of 100%. However, in FIG. 24, it is actually 50%. Since the error of the probability of occurrence is 50%, in the block B422, the determination device 38 determines that the difference between the actual probability and the planned probability is equal to or greater than a predetermined threshold value.

FIG. 25 is a diagram showing an example of information regarding the actual occurrence probability of the state transition of the manufacturing apparatus 22 at the time of abnormality. The error threshold is assumed to be 10%. According to the rule of FIG. 22, when the manufacturing apparatus 22 is in the standby state, the probability that the transition to the substrate loading state should occur should be a planned probability of 100%, but in FIG. 25, it is actually 80%. Since the error of the probability of occurrence is 20%, in the block B422, the determination device 38 determines that the difference between the actual probability and the planned probability is equal to or greater than a predetermined threshold value.

In the block B 420, the determination device 38 may obtain the actual occurrence probability of only one or a plurality of the transition to the next state, the control command, or the operation record information.

A modified example of the example according to the flowchart of FIG. 20 will be described. FIG. 26 is a diagram showing an example of a rule regarding the probability of occurrence of the next command in the normal state. FIG. 26 defines the current control command, the next control command, and the scheduled probability. This figure corresponds to FIGS. 21 and 22. For example, when the board carry-in command is generated, the manufacturing apparatus 22 transitions to the board carry-in state, so that the probability that the board mounting command will be generated next is 90%. Information such as that shown in FIG. 26 is statistically obtained in advance and stored in the storage device 42.

In block B416, the selector 36 reads a rule as shown in FIG. 26 from the storage device 42 instead of the rule as shown in FIG. 22. In block B420, the determination device 38 obtains the actual probability of occurrence of each type of control command that occurs next for each type of control command that has occurred. The determination device 38 obtains such an occurrence probability while sequentially performing reception processing of a plurality of packets.

In block B422, the determination device 38 determines whether or not the error of the actual occurrence probability, that is, the difference between the actual occurrence probability and the scheduled probability of the next command is equal to or more than a predetermined threshold value. If the difference between the actual occurrence probability and the planned probability is equal to or greater than a predetermined threshold value, the process proceeds to the block B24, and in other cases, the process proceeds to the block B26.

According to this example, it can be determined that there is an abnormality in the manufacturing system 100 only from the type of the generated command.

A further modification of the example according to the flowchart of FIG. 20 will be described. FIG. 27 is a diagram showing an example of a rule regarding the probability of occurrence of the next operation record information in a normal state. FIG. 27 defines the current operation record information, the next operation record information, and the planned probability. This figure corresponds to FIGS. 21 and 22. For example, when the board loading time occurs as the operation record information, the manufacturing apparatus 22 transitions to the board mounting state, so that the probability that the board mounting time will occur next as the operation record information is 85%. Information as shown in FIG. 27 is statistically obtained in advance and stored in the storage device 42.

In block B416, the selector 36 reads a rule as shown in FIG. 27 from the storage device 42 instead of the rule as shown in FIG. 22. In block B420, the determination device 38 obtains the actual occurrence probability of each type of operation record information that is generated next for each type of operation record information that has occurred. The determination device 38 obtains such an occurrence probability while sequentially performing reception processing of a plurality of packets.

In block B422, the determination device 38 determines whether or not the error of the actual occurrence probability, that is, the difference between the actual occurrence probability and the scheduled probability of the next operation record information is equal to or more than a predetermined threshold value. If the difference between the actual occurrence probability and the planned probability is equal to or greater than a predetermined threshold value, the process proceeds to the block B24, and in other cases, the process proceeds to the block B26.

According to this example, it can be determined that there is an abnormality in the manufacturing system 100 only from the type of the generated operation record information.

FIG. 28 is a flowchart showing a further modification of the flowchart of FIG. The flowchart of FIG. 28 differs from the flowchart of FIG. 13 in that it has blocks B516 and B522, respectively, instead of blocks B16 and B22, and further has block B520. Since other points are the same as those in FIG. 13, the description thereof will be omitted. In FIG. 28, the payload of the packet contains a control command or an operation record notification.

FIG. 29 is a state transition diagram of the manufacturing apparatus 22, and shows the time from each state to the next state. FIG. 30 is a diagram showing an example of a rule regarding the time required for the state transition of the manufacturing apparatus 22 in the normal state. FIG. 30 shows the current state (transition source) of the manufacturing apparatus 22, the next state (transition destination), the scheduled time required for the transition, the control command for the manufacturing apparatus 22 to transition to the state, and the manufacturing apparatus 22. The operation record information in the operation record notification that occurs when the state transitions is specified. For each state, the scheduled time from that state to the output of the next control command or operation record information is the same as the scheduled time required for the transition to the next state. For example, when the manufacturing apparatus 22 is in the board loading state, the scheduled time required for the next transition to the board mounting state is 10 seconds, and at the time of the transition, the board mounting command for transitioning the state Is output, and an operation record notification including the time required to carry in the board and the device status information as the operation record information is output. For columns where control commands are not described, transitions occur even if control commands are not output. Information as shown in FIG. 30 is statistically obtained in advance and stored in the storage device 42. Similar information is stored in the manufacturing apparatus 24.

In block B516, the selector 36 selects and reads the syntax and rules corresponding to the data type obtained by the analyzer 34 from the data stored in the storage device 42. The selector 36 outputs the read syntax and rules to the determiner 38 together with the input packet. For example, information as shown in FIGS. 8 and 10 is read out as a syntax, and further, a rule as shown in FIG. 30 is read out.

In the block B520, the determination device 38 obtains the actual time required for the transition to the next state, the output of the control command, or the output of the operation record information for each state of FIG. 29. The determination device 38 obtains such a time while sequentially performing reception processing of a plurality of packets.

In block B522, the determination device 38 determines whether or not the error of any actual time, that is, the difference between any actual time and the scheduled time is equal to or greater than a predetermined threshold value. If the difference between any of the actual times and the scheduled time is equal to or greater than a predetermined threshold value, the process proceeds to the block B24, and in other cases, the process proceeds to the block B26.

FIG. 31 is a diagram showing an example of information regarding the actual time until the output of the control command at the time of abnormality. The error threshold is assumed to be 15 seconds. According to the rule of FIG. 30, the time from when the manufacturing apparatus 22 is in the board mounting state to when the substrate unloading command for transitioning to the board unloading state is output should be a scheduled time of 10 seconds. , In FIG. 3, it is actually 100 seconds. Since the time error is 90 seconds, in the block B522, the determination device 38 determines that the difference between the actual time and the scheduled time is equal to or greater than a predetermined threshold value.

FIG. 32 is a diagram showing an example of information regarding the actual time until the output of the operation record information at the time of abnormality. The error threshold is assumed to be 15 seconds. According to the rule of FIG. 30, the scheduled time is 10 from the time when the manufacturing apparatus 22 is in the board mounting state until the operation result notification including the equipment mounting time is output when the manufacturing apparatus 22 transitions to the board unloading state. Where it should be seconds, in FIG. 32 it is actually 100 seconds. Since the time error is 90 seconds, in the block B522, the determination device 38 determines that the difference between the actual time and the scheduled time is equal to or greater than a predetermined threshold value.

FIG. 33 is a diagram showing an example of information regarding the actual time required for the state transition of the manufacturing apparatus 22 at the time of abnormality. The error threshold is assumed to be 15 seconds. According to the rule of FIG. 30, the time required for the manufacturing apparatus 22 to transition from the board mounting state to the board unloading state should be a scheduled time of 10 seconds, but in FIG. 33, it is actually 100 seconds. Since the time error is 90 seconds, in the block B522, the determination device 38 determines that the difference between the actual time and the scheduled time is equal to or greater than a predetermined threshold value.

In the block B520, the determination device 38 obtains only one or a plurality of the time required for the transition to the next state, the time until the output of the control command, or the time until the output of the operation record information. May be good.

A modified example of the example according to the flowchart of FIG. 28 will be described. FIG. 34 is a diagram showing an example of a rule regarding the time until the output of the next command in the normal state. FIG. 34 defines the current control command, the next control command, and the scheduled time. This figure corresponds to FIGS. 29 and 30. For example, when the board mounting command is output, the manufacturing apparatus 22 transitions to the board mounting state. Therefore, the scheduled time from the output of the board mounting command to the next output of the board unloading command is set. It is 10 seconds. Information as shown in FIG. 34 is statistically obtained in advance and stored in the storage device 42.

In block B516, the selector 36 reads a rule as shown in FIG. 34 from the storage device 42 instead of the rule as shown in FIG. 30. In the block B520, the determination device 38 obtains the actual time from the output of the control command to the next output of each type of control command for each type of output control command. The determination device 38 obtains such a time while sequentially performing reception processing of a plurality of packets.

In block B522, the determination device 38 determines whether or not the error in the actual time, that is, the difference between the actual time until the next command is output and the scheduled time is equal to or greater than a predetermined threshold value. If the difference between the actual time and the scheduled time is equal to or greater than a predetermined threshold value, the process proceeds to the block B24, and in other cases, the process proceeds to the block B26.

According to this example, it can be determined that there is an abnormality in the manufacturing system 100 only from the type of the generated command.

A further modification of the example according to the flowchart of FIG. 28 will be described. FIG. 35 is a diagram showing an example of a rule regarding the time until the output of the next operation record information in the normal state. FIG. 35 defines the current operation record information, the next operation record information, and the scheduled time. This figure corresponds to FIGS. 29 and 30. For example, when the board carry-in time is output as the operation record information, the manufacturing apparatus 22 transitions to the board mounting state. Therefore, after the board carry-in time is output, the board mounting time is output as the operation record information. The scheduled time until it is done is 10 seconds. Information as shown in FIG. 35 is statistically obtained in advance and stored in the storage device 42.

In block B516, the selector 36 reads a rule as shown in FIG. 35 from the storage device 42 instead of the rule as shown in FIG. 30. In the block B520, the determination device 38 obtains the actual time from the output of the operation record information to the next output of each type of operation record information for each type of output operation record information. .. The determination device 38 obtains such a time while sequentially performing reception processing of a plurality of packets.

In block B522, the determination device 38 determines whether or not an error in the actual time, that is, the difference between the actual time and the scheduled time until the next operation record information is output is equal to or greater than a predetermined threshold value. do. If the difference between the actual time and the scheduled time is equal to or greater than a predetermined threshold value, the process proceeds to the block B24, and in other cases, the process proceeds to the block B26.

According to this example, it can be determined that there is an abnormality in the manufacturing system 100 only from the type of the generated operation record information.

Note that the data analyzer 30 may learn from the payloads of a plurality of packets received by the transceiver 32, for example, the rules as shown in FIGS. 22, 26, 27, 30, 34 and 35. good. For example, by performing averaging processing for each condition such as a combination of a state and the next state from a plurality of packets, the scheduled probability and the scheduled time as described above are obtained in advance and stored in the storage device 42. deep.

FIG. 36 is a block diagram showing a configuration example of a computer system that realizes the data analysis device according to the embodiment of the present invention. The computer system 80 of FIG. 36 includes a processor 82, a transmitter / receiver 84, a bus 88, a memory 92, a file storage device 94, an input device 96, and a display 98.

The processor 82 communicates with other components via the bus 88. The transceiver 84 transmits / receives data to / from a communication network such as the Internet. The transceiver 84 may be wirelessly connected to the communication network.

The memory 92 includes, for example, a RAM (random access memory) and a ROM (read only memory), and stores data and instructions. The file storage device 94 is one or more volatile or non-volatile, non-transient, computer-readable storage media. When embodiments of the invention are realized in software, for example, microcode, assembly language code, or higher level language code may be used. The file storage device 94 stores a program described by these codes and including an instruction for realizing the function of the embodiment of the present invention. The file storage device 94 may include a RAM, a ROM, an EEPROM (electrically erasable programmable read only memory), a semiconductor memory such as a flash memory, a magnetic recording medium such as a hard disk drive, an optical recording medium, and a combination thereof.

The input device 96 may include a touch screen, a keyboard, a remote controller, a mouse, and the like. The display may include a flat panel display such as a liquid crystal display or an organic EL (electroluminescence) display.

The computer system 80 can operate as the data analyzer 30 of FIG. The processor 82 can operate as the analyzer 34, the selector 36, and the determiner 38 of FIG. The transceiver 84 can operate as the transceiver 32 in FIG. The file storage device 94 can operate as the storage device 42 of FIG.

Each functional block in the present specification can be realized by hardware such as a circuit. As an alternative, some or all of each functional block may be implemented in software. For example, such a functional block may be realized by a processor 82 and a program running on the processor 82. In other words, each functional block described herein may be implemented in hardware, software, or any combination of hardware and software.

The above embodiments are essentially preferred embodiments and are not intended to limit the scope of the invention, its applications, or its uses.

As described above, the present disclosure is useful for data analyzers, methods, programs and the like.

2 Network 10 Manufacturing control device 22, 24 Manufacturing device 30 Data analysis device 32 Transceiver (receiver)
34 Interpreter 36 Selector 38 Judgment 42 Storage device 100 Manufacturing system

Claims (19)

A data analysis device that analyzes data transmitted in a manufacturing system having a manufacturing device and a manufacturing control device that controls the manufacturing device.
A receiver that receives the first packet transmitted between the manufacturing control device and the manufacturing device, and
An analyzer that obtains the type of data contained in the payload of the received first packet from the received IP address and port number included in the header of the first packet.
A selector that selects a syntax or rule corresponding to the type of data based on the type of data obtained by the analyzer.
A data analyzer comprising a determination device for determining that there is an abnormality in the manufacturing system when the data contained in the payload does not follow the syntax or rules corresponding to the type of data. In the data analyzer according to claim 1,
The payload contains control commands and
The syntax is a data analyzer that is the syntax of the control command. In the data analyzer according to claim 1,
The payload includes an operation record notification of the manufacturing equipment.
The syntax is a data analysis device which is the syntax of the operation record notification. In the data analyzer according to claim 1,
The rule defines the order of the information indicated by the data contained in the payload of the first packet and the information indicated by the data contained in the payload of the second packet received before the first packet. Analysis equipment. In the data analyzer according to claim 4,
The payload of the first packet contains the first control command.
The payload of the second packet includes a second control command, and the first control command is a command following the second control command.
The data analyzer defines the order of the type of the first control command and the type of the second control command in the rule. In the data analyzer according to claim 4,
The payload of the first packet contains the first operation record information.
The payload of the second packet includes the second operation record information, and the first operation record information is the next notification of the second operation record information.
The rule defines the order of the type of the first operation record information and the type of the second operation record information. In the data analyzer according to claim 1,
The payload of the first packet contains control commands.
The rule stipulates the probability that the control command for the manufacturing device to transition to the second state will be generated when the manufacturing device is in the first state.
The determination device obtains the actual probability that the control command is generated when the manufacturing apparatus is in the first state, and when the difference between the actual probability and the planned probability is larger than a predetermined value, the determination device obtains the actual probability. A data analyzer that determines that there is an abnormality in the manufacturing system. In the data analyzer according to claim 1,
The payload of the first packet contains operation record information.
The rule stipulates the probability that the operation record information will be generated when the manufacturing apparatus transitions to the second state when the manufacturing apparatus is in the first state.
The determination device obtains the actual probability that the operation record information is generated when the manufacturing apparatus is in the first state, and when the difference between the actual probability and the planned probability is larger than a predetermined value. , A data analyzer that determines that there is an abnormality in the manufacturing system. In the data analyzer according to claim 1,
The rule stipulates the probability that the transition to the second state of the manufacturing device will occur when the manufacturing device is in the first state.
The determination device obtains the actual probability that the transition of the manufacturing apparatus to the second state occurs when the manufacturing apparatus is in the first state, and the difference between the actual probability and the planned probability is A data analyzer that determines that there is an abnormality in the manufacturing system when it is larger than a predetermined value. In the data analyzer according to claim 1,
The payload of the first packet contains the first control command.
The payload of the second packet received before the first packet includes a second control command, and the first control command is a command following the second control command.
The rule defines the probability that the first control command will be generated next to the second control command when the second control command is generated.
The determination device obtains the actual probability that the first control command is generated next to the second control command when the second control command is generated, and the difference between the actual probability and the scheduled probability is A data analyzer that determines that there is an abnormality in the manufacturing system when it is larger than a predetermined value. In the data analyzer according to claim 1,
The payload of the first packet contains the first operation record information.
The payload of the second packet received before the first packet includes the second operation record information, and the first operation record information is the next information of the second operation record information.
The rule stipulates the probability that the first operation record information will be generated next to the second operation record information when the second operation record information is generated.
The determination device obtains an actual probability that the first operation record information will occur next to the second operation record information when the second operation record information is generated, and the actual probability and the planned probability A data analyzer that determines that there is an abnormality in the manufacturing system when the difference between the two is larger than a predetermined value. In the data analyzer according to claim 1,
The payload of the first packet contains control commands.
The rule stipulates a scheduled time from when the manufacturing apparatus is in the first state until the control command for transitioning to the second state is output.
The determination device obtains the actual time from when the manufacturing apparatus is in the first state to when the control command is received, and the difference between the actual time and the scheduled time is larger than a predetermined value. A data analyzer that determines that there is an abnormality in the manufacturing system. In the data analyzer according to claim 1,
The payload of the first packet contains operation record information.
The rule stipulates the scheduled time from when the manufacturing apparatus is in the first state until the operation record information to be output when the manufacturing apparatus transitions to the second state is output. ,
The determination device obtains the actual time from when the manufacturing apparatus is in the first state to when the operation record information is output, and the difference between the actual time and the scheduled time is more than a predetermined value. A data analyzer that determines that there is an abnormality in the manufacturing system when it is large. In the data analyzer according to claim 1,
The rule stipulates the scheduled time from when the manufacturing apparatus is in the first state to when the manufacturing apparatus is in the second state.
The determination device obtains the actual time from when the manufacturing apparatus is in the first state to when the manufacturing apparatus transitions to the second state, and the difference between the actual time and the scheduled time is predetermined. A data analyzer that determines that there is an abnormality in the manufacturing system when it is larger than the value of. In the data analyzer according to claim 1,
The payload of the first packet contains the first control command.
The payload of the second packet received before the first packet includes a second control command, and the first control command is a command following the second control command.
The rule defines the scheduled time from the output of the second control command to the output of the first control command.
The determination device obtains the actual time from the output of the second control command to the output of the first control command, and the difference between the actual time and the scheduled time is larger than a predetermined value. A data analyzer that determines that there is an abnormality in the manufacturing system. In the data analyzer according to claim 1,
The payload of the first packet contains the first operation record information.
The payload of the second packet received before the first packet includes the second operation record information, and the first operation record information is the next information of the second operation record information.
The rule stipulates the scheduled time from the output of the second operation record information to the output of the first operation record information.
The determination device obtains the actual time from the output of the second operation record information to the output of the first operation record information, and the difference between the actual time and the scheduled time is a predetermined value. A data analyzer that determines that there is an abnormality in the manufacturing system when it is larger. In the data analyzer according to claim 1,
A data analyzer that learns the rules from the payloads of a plurality of packets received by the receiver. A data analysis method for analyzing data transmitted in a manufacturing system having a manufacturing apparatus and a manufacturing control apparatus for controlling the manufacturing apparatus.
Receiving a packet transmitted between the manufacturing control device and the manufacturing device, and
Obtaining the type of data contained in the payload of the received packet from the IP address and port number included in the header of the received packet, and
To select the syntax or rule corresponding to the type of data based on the type of data requested.
A data analysis method comprising determining that an abnormality is found in the manufacturing system when the data contained in the payload does not follow the syntax or rules corresponding to the type of data. A data analysis program that causes a computer to execute a data analysis method for analyzing data transmitted in a manufacturing system having a manufacturing device and a manufacturing control device that controls the manufacturing device.
The data analysis method is
Receiving a packet transmitted between the manufacturing control device and the manufacturing device, and
Obtaining the type of data contained in the payload of the received packet from the IP address and port number included in the header of the received packet, and
To select the syntax or rule corresponding to the type of data based on the type of data requested.
A data analysis program comprising determining that an abnormality is found in the manufacturing system when the data contained in the payload does not follow the syntax or rules corresponding to the type of data.

Images